name: Test E2E Admin UI

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened]
  workflow_dispatch:
    inputs:
      boundary-enterprise-branch:
        description: 'Branch of boundary-enterprise to test against (default to main)'
        required: true
        default: 'main'
        type: string
      boundary-branch:
        description: 'Branch of boundary to test against (default to main)'
        required: true
        default: 'main'
        type: string

jobs:
  test:
    name: test
    # don't need to run e2e tests on ce -> ent merges since tests were already
    # run in the ce branch, and there are currently no code diffferences between
    # the two repos
    if: github.actor != 'hc-github-team-secure-boundary'
    runs-on: ${{ fromJSON(vars.RUNNER_UBUNTU_22) }}
    strategy:
      matrix:
        boundary_edition: [community, enterprise]
        browser: [chromium, firefox, webkit]
        include:
          - boundary_edition: community
            github_repo: hashicorp/boundary
            folder_name: boundary
            boundary_edition_short: oss
            enos_scenario: e2e_ui_docker
            test_command: admin:ce:docker
            boundary_branch: ${{ github.event.inputs.boundary-branch || 'main' }}
          - boundary_edition: enterprise
            github_repo: hashicorp/boundary-enterprise
            folder_name: boundary-enterprise
            boundary_edition_short: ent
            enos_scenario: e2e_ui_docker_ent
            test_command: admin:ent:docker
            boundary_branch: ${{ github.event.inputs.boundary-enterprise-branch || 'main' }}
        # in boundary-ui-enterprise, only run tests on chromium because playwright dependencies can't
        # be installed on self-hosted runners due to permission issues
        exclude:
          - browser: ${{ github.repository == 'hashicorp/boundary-ui-enterprise' && 'firefox' }}
          - browser: ${{ github.repository == 'hashicorp/boundary-ui-enterprise' && 'webkit' }}
      fail-fast: false
    env:
      ENOS_VAR_e2e_debug_no_run: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Set up pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 #v6.0.8
        with:
          cache: true
          cache-dependency-path: |
            pnpm-lock.yaml
            ui/desktop/electron-app/pnpm-lock.yaml
          run_install: false

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85

      - name: Set up Enos
        uses: hashicorp/action-setup-enos@6ec106c8f809fe645162d73bea565c65f3269907
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Vault CLI
        run: |
          wget https://releases.hashicorp.com/vault/1.17.6/vault_1.17.6_linux_amd64.zip -O /tmp/vault.zip
          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
            unzip -o -q /tmp/vault.zip -d /usr/local/bin
          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
            unzip -o -q /tmp/vault.zip -d "$HOME/bin"
          fi

      - name: GPG setup
        run: |
          # Create a GPG key
          export KEY_PW=boundary
          gpg --generate-key --batch <<eoGpgConf
              %echo Started!
              Key-Type: RSA
              Key-Length: default
              Subkey-Type: RSA
              Name-Real: boundary
              Name-Comment: default
              Name-Email: default
              Expire-Date: 0
              Passphrase: $KEY_PW
              %commit
              %echo Done.
          eoGpgConf

          # Enable gpg-preset-passphrase so that key passwords can be saved
          echo "allow-preset-passphrase" >> ~/.gnupg/gpg-agent.conf
          gpg-connect-agent reloadagent /bye &>/dev/null

          # Get information about the created keys
          export lines=$(gpg --list-secret-keys --with-colons --with-keygrip)
          export KEY_ID=""
          while read -r line
          do
            # Save the first key id to be used later
            if [[ $line =~ "fpr"* ]]; then
              if [[ $KEY_ID == "" ]]; then
                KEY_ID="$(echo "$line" | sed -r 's/fpr|://g')"
              fi
            fi

            # Cache the passphrases for the keys so passwords do not need to be entered
            if [[ $line =~ "grp"* ]]; then
              export KEYGRIP_ID="$(echo "$line" | sed -r 's/grp|://g')"
              /usr/lib/gnupg/gpg-preset-passphrase --preset -P $KEY_PW $KEYGRIP_ID
            fi
          done <<< $lines

          # Trust the key
          touch /tmp/test.txt
          gpg -a --encrypt -r $KEY_ID --trust-model always --batch --yes /tmp/test.txt
          echo "trusted-key $KEY_ID" >> ~/.gnupg/gpg.conf

          # Initialize the password store
          sudo apt-get update
          sudo apt-get install -y pass
          pass init $KEY_ID &>/dev/null

      - name: Checkout ${{ matrix.folder_name }} repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ matrix.github_repo }}
          path: support/src/${{ matrix.folder_name }}
          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
          ref: ${{ matrix.boundary_branch }}

      - name: GH fix for localhost resolution
        run: |
          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
            cat /etc/hosts && echo "-----------"
            sudo sed -i 's/::1 *localhost ip6-localhost ip6-loopback/::1 ip6 -localhost ip6-loopback/g' /etc/hosts
            cat /etc/hosts
            ssh -V
          fi

      - name: Set git config
        run: |
          git config --global url."https://oauth2:${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com".insteadOf "https://github.com"

      - name: Install node dependencies
        run: |
          pnpm install --frozen-lockfile
          cd e2e-tests
          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
            pnpm playwright install --with-deps
          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
            # playwright dependencies can't be installed on a self-hosted runner
            # due to permission issues
            pnpm playwright install
          fi

      - name: Determine Go version
        id: get-go-version
        run: |
          echo "Building with Go $(cat ./support/src/${{matrix.folder_name}}/.go-version)"
          echo "go-version=$(cat ./support/src/${{matrix.folder_name}}/.go-version)" >> "$GITHUB_OUTPUT"

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ steps.get-go-version.outputs.go-version }}
          cache: false

      - name: Set up test infra
        id: infra
        run: |
          ssh-keygen -N '' -t ed25519 -f ~/.ssh/github_enos
          mkdir -p ./enos/terraform-plugin-cache

          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
            echo ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} > ./support/src/${{matrix.folder_name}}/internal/ui/VERSION
            export ENOS_VAR_ui_build_override="oss"
          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
            echo ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} > ./support/src/${{matrix.folder_name}}/internal/ui/VERSION_ent
            export ENOS_VAR_ui_build_override="enterprise"
          fi

          export ENOS_VAR_boundary_edition=${{ matrix.boundary_edition_short }} && \
          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
          export ENOS_VAR_boundary_license="${{ secrets.BOUNDARY_ENT_LICENSE }}" && \
          enos scenario launch --timeout 60m0s --chdir ./support/src/${{matrix.folder_name}}/enos ${{matrix.enos_scenario}} builder:local

      - name: Move boundary binary
        run: |
          if [[ "${{ github.repository }}" == "hashicorp/boundary-ui" ]]; then
            mv ./support/src/${{matrix.folder_name}}/bin/boundary /usr/local/bin/
          elif [[ "${{ github.repository }}" == "hashicorp/boundary-ui-enterprise" ]]; then
            mv ./support/src/${{matrix.folder_name}}/bin/boundary $HOME/bin
          fi

          boundary version

      - name: Run Tests
        run: |
          source <(bash ./support/src/${{matrix.folder_name}}/enos/scripts/test_e2e_env.sh)
          cd e2e-tests
          pnpm run ${{ matrix.test_command }} --project=${{ matrix.browser}} --reporter=html

      - name: Upload Playwright report
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-${{ matrix.boundary_edition }}-${{ matrix.browser }}
          path: e2e-tests/playwright-report

      - name: Clean up test infra
        if: ${{ always() }}
        continue-on-error: true
        run: |
          export ENOS_VAR_boundary_edition=${{ matrix.boundary_edition_short }} && \
          export ENOS_VAR_enos_user=$GITHUB_ACTOR && \
          export ENOS_VAR_aws_ssh_private_key_path=~/.ssh/github_enos && \
          enos scenario destroy --timeout 60m0s --chdir ./support/src/${{matrix.folder_name}}/enos ${{matrix.enos_scenario}} builder:local

      - name: Send Slack message on failure
        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
        if: ${{ failure() && github.repository == 'hashicorp/boundary-ui' }}
        with:
          method: chat.postMessage
          token: ${{ secrets.SLACK_BOT_TOKEN }}
          payload: |
            channel: ${{ secrets.SLACK_CHANNEL_ID }}
            text: ":x: admin ui e2e tests (${{ matrix.boundary_edition }}:${{ matrix.browser }}) failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Branch:* ${{ github.repository }}:${{ github.head_ref || github.ref_name }}"